Subject Access Request to Santander UK

Santander takes subject access requests five ways: its online Information Rights Request form, post to Subject Access Requests, Sunderland SR43 4FN, phone, in branch, or the chat service in Online Banking. It publishes no email address for making a request, and its "Using my personal data" booklet advises against using unsecured channels such as normal email — if you would rather write than use the form, write your own letter and post it, and when the response arrives you can check whether it is complete. This page covers Santander UK plc, whose ICO registration also lists the names cahoot, Abbey and Santander Corporate and Commercial Bank. The same booklet still prints an earlier postal route (Subject Access Requests, Santander UK plc, PO BOX 1111, Bradford BD1 9NQ); the Sunderland address above is the one on Santander's current data protection page. A car or motorcycle finance agreement is a different company and a different request. Santander Consumer (UK) plc is a separate data controller based in Redhill: a request to the retail bank is a request to a different company. Santander Consumer publishes its own request form and its own response-time expectation — 28 days on its request page, 30 in its privacy policy; the statutory entitlement is one calendar month either way. If your question is about commission on a motor finance agreement, a subject access request can show you what was recorded — Santander Consumer's own request form has a Commission information option — but it is not the way to claim money back. The Financial Conduct Authority's redress scheme is the route for that, and the scheme's dates are on Santander Consumer's own commission complaints page, which it keeps updated. Cater Allen Private Bank is also its own controller, with a postal-only route: Subject Access Requests, Client Team, Cater Allen Operations, Sunderland, SR43 4FB. That postcode is one character from this page's, and the name on the envelope is what routes the letter. Jersey and Isle of Man accounts branded Santander International are, by that service's own privacy statement, held by Santander Financial Services plc, whose Data Protection Officer is at 13 - 15 Charing Cross, St Helier, Jersey JE2 3RP. The same statement lists the Jersey and Isle of Man information regulators alongside the UK ICO for complaints. Closing an account does not erase the file: Santander's own guidance says that if you open an account, your information will be kept after the account is closed, and the right of access applies to whatever is still held. Santander names three fraud prevention agencies it shares personal data with — Cifas, National Hunter and National SIRA. Each is a controller in its own right, holding its own records about you. Data protection rights end at death, so records about someone who has died cannot be requested this way; Santander has a separate bereavement support route.

Made under UK GDPR Article 15

Banks hold considerably more about you than statements: call recordings, branch and chat notes, complaint files, internal correspondence, fraud and affordability assessments, and the reasoning recorded behind lending decisions. Statements are usually available in online banking already, so a SAR is most useful for everything that is not.

Requests here are usually made for a reason — a complaint, a disputed transaction, an affordability argument, or a fraud marker. Being specific about dates, account numbers and the events you care about produces a far more useful response than a blanket request for everything.

Fraud markers are often not held by the bank alone. CIFAS and National Hunter are separate organisations and separate data controllers, and a marker recorded with them needs its own request sent directly to them.

• Call recordings and contact notes
• Complaint files and internal investigation notes
• Lending and affordability decision records
• Fraud markers and the reasons recorded for them
• Account opening and closure correspondence

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.